CVE-2022-2834 Helpful < 4.5.26 - Information Disclosure
Attackers can download publicly accessible log files to retrieve sensitive user data like IPs and emails from the Helpful plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-2834?
CVE-2022-2834 is a medium-severity vulnerability in Unknown Helpful, published on 17 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Helpful WordPress plugin before 4.5.26 puts the exported logs and feedbacks in a publicly accessible location and guessable names, which could allow attackers to download them and retrieve sensitive information such as IP, Names and Email Address depending on the plugin's settings
Weakness: CWE-552
Which versions are affected by CVE-2022-2834?
It affects 1 product.
Products include Helpful Project Helpful.
How do I fix CVE-2022-2834?
No fix has been published for CVE-2022-2834 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-2834 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2834 exists.
Other vulnerabilities in Unknown Helpful
Sources
Also known as GHSA-6j5r-8vhm-p3x4.